Splunk Search

How to update a new row in lookup file using eval command or some other command?

Rajiv_splunk
Path Finder

Hello everyone,

I have a lookup file which have 5 entry with filed name and field value as below

"New_field"="yes", New_field1="yes", "New_field3"="yes", New_field4="Yes"

I need to append a new row to the lookup file with all the field value as "No". I am using the below command to do this

|inputlookup sample_demo.csv
|append [|inputlookup sample_demo.csv|eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]

this query is adding the new row but its adding 5 new row... I just need one row to append with new field value as "no"

Can anyone please guide me on this, as what am i missing in the query

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There's no need to re-read the lookup file in the append.  Just append the new fields and write the whole thing back to the lookup.

|inputlookup sample_demo.csv
|append [ | makeresults 
  |eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]
| outputlookup sample_demo.csv

You also can do it without reading the lookup.

| makeresults
| eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"
| table New_field, New_field1, New_field2, New_field3, New_field4
| outputlookup append=1 sample_demo.csv
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Rajiv_splunk
Path Finder

i got it fixed...run the eval command again...Thanks 

0 Karma

Rajiv_splunk
Path Finder

I got stuck in an another issue..how would i add multiple rows in lookup file through query if only one field vlaue i have to change. say i also have to add all the field value as "yes" and all the field value as "accepted"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no need to re-read the lookup file in the append.  Just append the new fields and write the whole thing back to the lookup.

|inputlookup sample_demo.csv
|append [ | makeresults 
  |eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"]
| outputlookup sample_demo.csv

You also can do it without reading the lookup.

| makeresults
| eval "New_field"="no", New_field1="no", "New_field3"="no", New_field4="no"
| table New_field, New_field1, New_field2, New_field3, New_field4
| outputlookup append=1 sample_demo.csv
---
If this reply helps you, Karma would be appreciated.

Rajiv_splunk
Path Finder

Thanks  a ton @richgalloway for your quick reply.  It works like a charm :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...